fmorg-git commented on code in PR #11095:
URL: https://github.com/apache/ozone/pull/11095#discussion_r3847659360
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/s3/security/S3AssumeRoleRequest.java:
##########
@@ -182,7 +185,7 @@ public OMClientResponse validateAndUpdateCache(OzoneManager
ozoneManager, Execut
final long expirationEpochSeconds =
clock.instant().plusSeconds(durationSeconds).getEpochSecond();
// Add tempAccessKeyId to the log so it can be determined which
permanent user created the tempAccessKeyId
- auditMap.put("tempAccessKeyId", tempAccessKeyId);
+ auditMap.put(OzoneConsts.S3_STS_TEMP_ACCESS_KEY_ID, tempAccessKeyId);
Review Comment:
So the `user` field in the om audit log is essentially the
`originalAccessKeyId`. A sample om audit log entry is below:
```
2026-08-23 22:23:09,651 | INFO | OMAudit |
user=svc-iceberg-rest-catalog/[email protected] | ip=172.25.0.120 |
op=S3_ASSUME_ROLE
{"duration":"900","Transaction":"283","isPolicyIncluded":"Y","roleArn":"arn:aws:iam::123456789012:role/sts-temp-bucket-access","requestId":"c2ebe586-df7b-41d9-a964-811312c4a199","roleSessionName":"sts-session-name","action":"AssumeRole","tempAccessKeyId":"ASIA3X2X4JL0GBX0595DU2MU"}
| ret=SUCCESS |
```
Just confirming if we still need to add a separate `originalAccessKeyId`
parameter?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
